aCropalypse, bug muPixel zvishandiso zvinokutendera kuti udzorere skrini

ngozi

Kana dzikashandiswa, zvikanganiso izvi zvinogona kubvumira vanorwisa kuti vawane mukana usina mvumo kune ruzivo rwakadzama kana kuti kazhinji kukonzera matambudziko.

Ruzivo rwakaburitswa nezve kusagadzikana (yakatonyorwa pasi peCVE-2023-21036) yakaonekwa muMarkup app inoshandiswa mukati mafoni Google Pixel kurima uye kugadzirisa zvidzitiro, izvo zvinobvumira kudzoreredza zvishoma kweruzivo rwakadzvanywa kana rwakagadziridzwa.

Mainjiniya Simon Aarons naDavid Buchanan, vakawana bug uye vakagadzira chishandiso che kupora kwe uchapupu hweConcept, zvichiteerana, vakaitumidza kuti Cropalypse uye vakacherekedza kuti "bug iyi yakaipa" kune vanhu vane hanya nezve yavo yekuvanzika.

Izvi zvinoreva kuti kana mumwe munhu akabata mufananidzo wako wakadzvanywa, vanogona kuyedza kutora chikamu chinenge chisipo. Kana mufananidzo wacho wakaitwa nemavara pane dzimwe nzvimbo, nzvimbo idzodzo dzinogona kuonekwa mumufananidzo wakadzorerwa. Izvi hazvina kunaka kuvanzika.

Dambudziko inozviratidza paunenge uchigadzirisa mifananidzo yePNG muMarkup uye inokonzerwa nekuti kana mufananidzo mutsva wakagadziridzwa wakanyorwa, iyo data inokwidziridzwa pane yapfuura faira pasina truncation, kureva, iyo yekupedzisira faira yakawanikwa mushure mekugadzirisa inosanganisira muswe weiyo sosi faira, iyo iyo data inoramba iripo. compressed data.

Dambudziko Inorongwa sekusagadzikana. sezvo mushandisi achigona kutumira mufananidzo wakagadziridzwa mushure mekubvisa data rakavanzika, asi chaizvo iyi data inoramba iri mufaira, kunyangwe isingaonekwe panguva yekutarisa kwakajairika. Kuti udzorere data yasara, iyo acropalypse.app web service yakatangwa uye muenzaniso wePython script wakaburitswa.

Kusagadzikana kwave kuoneka kubvira Google Pixel 3 yakatevedzana yemafoni yakatangwa muna 2018 ichishandisa firmware yakavakirwa pa Android 10 uye neshanduro nyowani. Nyaya yakagadziriswa munaKurume Android firmware update yePixel smartphones.

"Mugumo ndewekuti faira remufananidzo rinovhurwa pasina [truncated] mureza, kuitira kuti kana mufananidzo wakadzvanywa wanyorwa, mufananidzo wekutanga haudzoreki," akadaro Buchanan. "Kana iyo faira yemufananidzo mutsva idiki, magumo ekutanga anosara kumashure."

Iwo machunks efaira aifanirwa kuchekwa akawanikwa achidzoserwa semifananidzo mushure mekuita imwe reverse engineering yezlib compression library methodology, iyo Buchahan anoti akakwanisa kuita "mushure memaawa mashoma ekutamba." Mhedzisiro iyi humbowo hwepfungwa yekuti chero munhu ane Pixel akakanganisika mudziyo anogona kuzviedza ega.

Zvinotendwa kuti nyaya yacho imhaka yeshanduko isina kunyorwa hunhu hweParcelFileDescriptor.parseMode() nzira. , umo, kusati kwaburitswa Android 10 papuratifomu, iyo "w" (nyora) mureza yakakonzera kuti faira ridzimurwe paunenge uchiedza kunyora kune faira yagara iripo, asi kubva pakaburitswa Android 10, maitiro akachinja uye pakudzikisira zvaidiwa kutsanangura zvakajeka mureza we "wt" (nyora, dzikamisa) uye kana mureza we "w" watsanangurwa, mutsara hauna kuzobviswa mushure mekunyorazve. .

Muchidimbu, chikanganiso che "aCropalypse" chakabvumira mumwe munhu kuti atore yakadzvanywa PNG skrini muMarkup uye agadzirise angangoita mamwe ekugadzirisa kumufananidzo. Zviri nyore kufungidzira zviitiko umo mutambi akaipa anogona kushandisa zvisirizvo kugona ikoko. Semuyenzaniso, kana muridzi wePixel akashandisa Markup kugadzirisa mufananidzo waisanganisira ruzivo rwakadzama nezvake, mumwe munhu anogona kushandisa chakakanganisika kuratidza ruzivo irworwo.

Zvakakodzera kutaura izvozvo Google yakabata Cropalypse mavari Kurume Pixel kuchengetedza inogadziridza (nguva pfupi ruzivo rwekusagadzikana rwusati rwaburitswa):

Zvese zvakanaka uye zvakanaka mune ramangwana: ikozvino unogona kurima, kugadzirisa, uye kugovera usingatyi kuti mifananidzo yako yeramangwana inogona kudzoserwa, asi hapana asina kugovaniswa zvidzitiro zviri panjodzi yekubirwa akatopfuura, akaiswa kuDiscord, nezvimwe. 

Finalmente kana iwe uchifarira kuziva zvakawanda nezvazvo pamusoro pekusagadzikana, unogona kutarisa chinyorwa chekutanga pa chinotevera chinongedzo.


Siya yako yekutaura

Your kero e havazobvumirwi ichibudiswa. Raida minda anozivikanwa ne *

*

*

  1. Inotarisira data: AB Internet Networks 2008 SL
  2. Chinangwa cheiyo data: Kudzora SPAM, manejimendi manejimendi.
  3. Legitimation: Kubvuma kwako
  4. Kutaurirana kwedata
  5. Dhata yekuchengetedza: Dhatabhesi inobatwa neOccentus Networks (EU)
  6. Kodzero: Panguva ipi neipi iwe unogona kudzora, kupora uye kudzima ruzivo rwako